Stuxnet is probably the most interesting piece of malware I've ever covered, and the more we learn about it, the more it seems to have been ripped from the pages of a spy novel. A targeted attack that used four zero-day attacks, compromised digital certificates, inside knowledge of a specific industrial computer installation, it was launched by someone or some group that apparently didn't really care if its target ever found out about the attack.

I've been trying to get Ralph to give me an interview for several days now, but he's not ready to talk quite yet. In the interim, however, he did email me this blow-by-blow description of how he thinks Stuxnet was executed. To me, what he says seems completely credible. It's a very interesting description of an incredibly sophisticated operation.

- Contact to command & control servers for updates, and for evidence of compromise (important)

- Update local peers by using embedded peer-to-peer networking

- shut down CC servers

Stage 3, execution:

- Check controller configuration

- Identify individual target controllers

- Load rogue ladder logic

- Hide rogue ladder logic from control system engineers

- Check PROCESS condition

- Activate attack sequence

What this shows is that the 0day exploits were only of temporary use during the infiltration stage. Quite a luxury for such sophisticated exploits! After the weapon was in place, the main attack is executed on the controllers. At that point, where the rogue ladder logic is executed, it’s all solid, reliable engineering – attack engineering.